Migration 1.17.3 changes in 1.18.2 #242
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mbrulatout
commented
Jun 19, 2024
•
mbrulatout
commented
- api: non-connect endpoints give downstream connect informations
- Get sidecar weights from node service if not specified
- Set KnownLeader by default when streaming is activated
- connect: re-add common name on secondary CA intermediate certificate
- Add test to strip version to avoid any leading/trailing whitespaces/newlines
- Add option in prepared query to skip local datacenter
- Allow to override DeregisterCriticalServiceAfter for sidecar services
- Connect: re-align root CA state if needed
- audit: add audit logs for ACL/catalog/KV operations : 43c4b39 + 1548631
- some linter fix
- bump minor version to criteo2
mbrulatout
force-pushed
the
1.18.2-criteo
branch
2 times, most recently
from
68b62a3 to
b9664a9
Compare
provide enough connect information to use consul connect
The sidecar service weight was set to default values if not specified by use in connect block of service definition. This patch aims of reusing the node service weights if no weights is specified from connect definition block.
This is not a real fix but will avoid breaking clients relying on this header Change-Id: I21b93173f17d1187d8ca49f5869ef8cd4c8d21b5
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
- Add option SkipLocalDatacenter in Failover section, defaulted to false, which enable the possibility to never execute the query in the local datacenter when set to true. - Also when the option is enabled, if the local datacenter is listed in the failover datacenters, execute the query locally instead of triggering remotely. - Add more tests on prepared query This patch solves issue described in hashicorp#3250
When no checks are defined for sidecar services, some default ones are defined. But those checks don't have any user defined attributes. In this patch, add feature to set from config the parameter DeregisterCriticalServiceAfter for all connect default checks. If none is defined by user, this attribute will be ignored by consul, since 0 (default value) is ignored.
This prevents state to drift if structs.CARoot gets modified and a new field is added. It is important to ensure results from /v1/connect/ca/roots, which return data from state, are consistent. For instance, on a cluster that has been setup in 2018, we observed empty ExternalTrustDomain, as well as PrivateKeyType and PrivateKeyBits. Without this patch, one would need to wait a rotation to fix state, which happens every 5 years by default. Also address TODO that was here now we have strong guarantees that rootCA and activeRoot are the same, and add a test to ensure idempotency.
Hook into each function and get all the return flows to catch the error (if any) through a defer statement. This requires small changes to declare some variables before the defer block. K/V values and policy rules are base64 encoded when adding an audit log entry to avoid messing with our syslog setup which can't handle multi-line logs
mbrulatout
requested review from
dclaisse,
pierrecdn,
cpaillet,
mougams and
manu-ns
mougams
approved these changes
Jun 19, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.